Shadowfi

CertiKFiles named in the report

CertiK reviewed ShadowFi on 21 Oct 2022: 18 findings, 0 critical; 8 marked fixed, 1 acknowledged, 9 open.

No open critical findings
Open the reportOpen ShadowFi’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings18

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High010
Medium000
Low908
HighCentralization Related RisksAcknowledged

In the Contract `[ShadowFi.sol]`, when the function `addLiquidity` is called, the `autoLiquidityReceiver` will receive the LP tokens. In the contract `[ShadowFi.sol]`, the role `[onlyOwner]` has authority over the following functions: - `setGasPriceLimit()` - allows the Owner to set the Gwei to X to combat sniping in early blocks. - `enableGasLimit()` - enables anti-sniping measures. - `airdrop()` - airdrops token to users. - `setBlackListed()` - blacklists an address from the system. - `setAuthorized()` - sets an address to gain a centralized role. - `transferOwnership()` - transfers the ownership of the contract. - `withdrawBNB()` - take BNB stuck in contract. In the contract `[ShadowFi.sol]`, the role `[forAuthorize]` has authority over the following functions: - `authorizeFor()` - Sets an address to be allowed to use a certain permissioned function. - `authorizeForMultiplePermissions()` Allows an address to be given access to multiple permissioned functions. - `unauthorizeFor()` - Removes permissions from an address. - `lockPermission()` - Locks the permission from being used for X time. - `unlockPermission()` - Unlocks the permission after locking has passed. - `triggerBuyback()` - Triggers purchase and sends them to zero address. - `clearBuybackMultiplier()` - Sets the multiplier to zero. - `setBuybackMultiplierSettings()` - Sets the inputs to a certain amount for buy backs. - `setTxLimit()` - Sets the transaction limit to a max amount. In the contract `[ShadowFi.sol]`, the role `[authorized]` has authority over the following functions: - `setBuybackMultiplierSettings()` - Sets the multiplier settings. - `setIsFeeExempt()` - Sets addresses to be exempt from fees. - `setIsDividendExempt()` - Sets addresses to be exempt from dividends. Any compromise to the `[onlyOwner]`, `[authorizedFor]`, and `[onlyToken]` accounts inside of `[ShadowFi.sol]` may allow a hacker to take advantage of this authority. In the contract `Ownable` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this. ![](https://accelerator-tasks-prod.acc.corp.certik.com/cdf2d6c3343e4d579e536efe1468e300/diagrams/centralization_ShadowFiLiquidityVault-Ownable-_owner.svg) In the contract `ShadowFiLiquidityLock` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this. ![](https://accelerator-tasks-prod.acc.corp.certik.com/cdf2d6c3343e4d579e536efe1468e300/diagrams/centralization_ShadowFiLiquidityVault-ShadowFiLiquidityLock-_owner.svg)

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (2)

  • ShadowFi.sol
  • ShadowFiLiquidityVault.sol

Part of ShadowFi’s security record

ShadowFi
Audits2 audits by 2 firmsLast audit May 2024, by Cyberscope.
Critical findings2 open critical findingsReported in “ShadowGold” by Cyberscope, May 2024. Not marked fixed in that report.
Open ShadowFi’s security record

Security firm

CertiK

1,044 projects reviewed · 1,375 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us